It's variable-sized but it's okay as long as the total size doesn't
exceed SRP_MAX_IU_LEN. So it's not a bug, but I agree it's a time bomb.
Moving the field last should work, but it would still be quite
dangerous code.

Yeah I reached the same conclusion.
I'll send a fix for the dangerous code.

Do you want to drop this series, or only the change in 'struct srp_rsp'
(or in all hw/scsi/srp.h). Actually I guess it makes sense I move the
'hw/scsi/srp.h' changes with the series cleaning dangerous code.